4 ms·

Think of security as reducing risk. If you're invisible your risk is lower because you have a lower chance of being targeted. This is wholly separate from wha

Think of security as reducing risk. If you're invisible your risk is lower because you have a lower chance of being targeted. This is wholly separate from what happens if you're hit. That's resilience, or armor, or whatever we want to call that. But both reducing the probability of being a target and being more resilient once you are a target qualify as security.

x1798DE 10y ago
This is not invisiblity. It's putting your safe door behind a curtain. Yes, fewer people are seeing the safe, but the curtain is not actually increasing your security, it's just preventing casual attackers from seeing you as a target of opportunity (who, for the most part, are also not going to get past real security, anyway). I don't know that it's dangerous, but it's not really additional meaningful security, in my opinion, so long as it has zero downsides. The example of the NSA keeping their algorithm hidden does have downsides. One of the biggest downsides of doing some non-standard thing is that you might not realize that you are actually weakening your security. If you have some protocol that involves not revealing the existence of a server to casual attackers, that's completely fine with me, but it's worth noting how easily these things can get conflated together.
- danielrm26 10y ago
  It's the same as cloaking a tank in a tank battle. If you didn't take the armor off it's great. But if you did then you've put your eggs in the don't get hit basket. The trick is figuring out if you could have bought more armor with the money you spent on the cloaking device. Or, if enemy weapons are so good that armor doesn't matter, then it's time to think about cloaking very seriously. It's a balance between probability and impact. With cloaking you're reducing likelihood. With armor you're reducing impact. But in both cases you're reducing risk.

x1798DE 10y ago

This is not invisiblity. It's putting your safe door behind a curtain. Yes, fewer people are seeing the safe, but the curtain is not actually increasing your security, it's just preventing casual attackers from seeing you as a target of opportunity (who, for the most part, are also not going to get past real security, anyway). I don't know that it's dangerous, but it's not really additional meaningful security, in my opinion, so long as it has zero downsides. The example of the NSA keeping their algorithm hidden does have downsides. One of the biggest downsides of doing some non-standard thing is that you might not realize that you are actually weakening your security. If you have some protocol that involves not revealing the existence of a server to casual attackers, that's completely fine with me, but it's worth noting how easily these things can get conflated together.

danielrm26 10y ago
It's the same as cloaking a tank in a tank battle. If you didn't take the armor off it's great. But if you did then you've put your eggs in the don't get hit basket. The trick is figuring out if you could have bought more armor with the money you spent on the cloaking device. Or, if enemy weapons are so good that armor doesn't matter, then it's time to think about cloaking very seriously. It's a balance between probability and impact. With cloaking you're reducing likelihood. With armor you're reducing impact. But in both cases you're reducing risk.